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Abstract 

Entanglement has been termed a critical resource for quantum information process- 
ing and is thought to be the reason that certain quantum algorithms, such as Shor's 
factoring algorithm, can achieve exponentially better performance than their clas- 
sical counterparts. The nature of this resource is still not fully understood: here we 
use numerical simulation to investigate how entanglement between register qubits 
varies as Shor's algorithm is run on a quantum computer. The shifting patterns in 
the entanglement are found to relate to the choice of basis for the quantum Fourier 
transform. 
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1 Introduction 



Quantum computation has the potential to provide significantly more power- 
ful computers than classical computation - if we can build them. There are 
numerous possible routes forward for quantum hardware however, progress 
in the development of algorithms has been slow, in part because we don't yet 
fully understand how the quantum advantage works. There are two key char- 
acteristics of the quantum resources used for computation. The first is that 
a general superposition of 2 n levels may be represented in n 2-level systems 
0, allowing the the physical resource to grow only linearly with n (quantum 
parallelism). The second aspect is best explained by considering the classical 
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computational cost of simulating a typical step in a quantum computation. If 
entanglement is absent then the algorithm can be simulated with an equivalent 
amount of classical resources. Jozsa and Linden (if showed that, if a quantum 
algorithm cannot be simulated classically using resources only polynomial in 
the size of the input data, then it will have multipartite entanglement involv- 
ing unboundedly many of its qubits - if it is run on a quantum computer using 
pure quantum states. However, the presence of multipartite entanglement is 
not a sufficient condition for a pure state quantum computer to be hard to 
simulate classically. As Jozsa and Linden point out, if the quantum computer 
is described using stabilizer formalism 0, || , there are many highly entangled 
states that have simple classical descriptions. Moreover, a quantum computer 
using mixed states may still require exponential classical resources to simu- 
late even if its qubits are not entangled, and it is not known whether such 
states may be used to perform efficient computation. In any case, being hard 
to simulate classically doesn't imply the quantum process is doing any useful 
computation. If we want to understand quantum computation, we will have 
to look more closely at specific examples. 

Few quantum algorithms provide an exponential speed up over classical algo- 
rithms, of those that do, Shor's algorithm (order-finding) [(J is perhaps the 
most important because it can be used to factor large numbers and hence has 
implications for classical security methods. There is no proof that an equally 
efficient classical algorithm cannot exist for Shor's algorithm, and it is worth 
noting that a sub-exponential algorithm has been found recently for the re- 
lated problem of primality testing Q . Proving a speed up is in general a tough 
task, few such proofs exist for exponential speed up of quantum over classical, 
one example being a quantum walk algorithm with a proven exponential speed 
up (w.r.t. an oracle) [8|. 

Assuming that Shor's algorithm does provide an exponential speed up, and 
given that multipartite entanglement is necessary (though not sufficient) for 
pure state quantum computation with an exponential speed up over classi- 
cal computation, in this paper we investigate what the entanglement is doing 
during the computational process, as it proceeds, gate by gate. To be clear, 
we reiterate that we are not trying to prove whether entanglement is present, 
we take it as given that there will be at least logr of entanglement entropy 
(where r is the period being determined, and logs are in base 2 throughout 
this paper) at the mid-point of Shor's algorithm, as first shown by Nielsen and 
Chuang |9| . Instead, we would like to know what role it plays in the computa- 
tion. What we have in mind is a role comparable to the role of entanglement 
in quantum communications, where a maximally entangled pair of qubits can 
be used to perform specific communications tasks (such as teleportation of 
an unknown quantum state 0], or transmission of two classical bits of in- 
formation (ll|), which consume the entanglement in direct proportion to the 
amount of communication achieved. To date, little has been said about what 
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role entanglement actually plays in quantum computation, the focus has been 
almost entirely on proving it is present, in sufficient quantities to make clas- 
sical simulation inefficient (besides 0|, see, for example, E0QE3)- we 



aim to throw some light on the question of what function it plays by calculat- 
ing the entanglement as it varies during the course of the execution of Shor's 
algorithm, and looking at how it correlates with the progress of the algorithm. 

For this study, we are using a standard gate sequence for Shor's algorithm 
using pure quantum states. Use of mixed states and different gate sequences 
may produce different entanglement patterns, but if there is a crucial role for 
entanglement in the computation, it will be identifiable as a common feature 
of all implementations. Parker and Plenio have presented a version of 
Shor's algorithm using only one pure qubit, the rest may start in any mixed 
state. They confirmed (numerically) that entanglement was present when the 
algorithm ran efficiently for factoring 15 and 21. 

We should also add that, since we are investigating the logical functioning 
of the algorithm, we are not concerned with any practical questions of im- 
perfect gates, decoherence, etc., nor with optimising the gate sequences given 
constraints on the number of qubits or the types of gates available. Much 
valuable work has been done in these areas by many authors, notably Vedral 
et al, Gossett (isj | . and Van Meter and Itoh [l£| on constructing efficient 
operations from elementary gates; Zalka and Beauregard |2l| who opti- 
mise the overall operation of Shor's algorithm in fewer qubits; and Fowler and 
Hollenberg who analyse scalability and accuracy. 



The organisation of this paper is as follows. We start with a brief overview 
of Shor's algorithm in §2, to set up our notation. This is followed in §3 by 
a discussion of how the entanglement varies in an instance of factoring 15, 
which also serves to introduce the entanglement measures we are using. In §4 
the pattern of entanglement in several examples of factoring 21 is presented. 
Larger semiprimes are tackled in §5, from which we are able to deduce our 
main conclusions, which are summarised in §6. 



2 Shor's Algorithm 



We begin with a brief overview of how Shor's algorithm works, in order to 
remind the reader and to establish our notation. We wish to factor a number 
N = pq where p and q are prime numbers. Classical number theory provides 
a way to determine these primes with high probability (not unity generally) 
by finding the period r of the function 

f x (a) = x a (mod iV), (1) 
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Fig. 1. Schematic circuit diagram of Shor's algorithm for factoring 15 implemented 
on a 12 qubit quantum register. The initialisation / is done with single qubit 
Hadamard (H) and bit-flip (Z) gates. Controlled-C/ x (j) gates are used to produce 
x a (mod N). The inverse quantum Fourier transform (IQFT) uses controlled rota- 
tions {Rm). The last quantum step is the measurement (M), which is followed by 
classical post-processing to obtain a factor of N. 

where x is an integer chosen to be less than N and co-prime to it, and a G Z. 
It is efficient to check whether x is co-prime to iV using Euclid's algorithm 
(HI . If x happens not to be co-prime then their common factor gives a factor 
of TV and the job is done, but this happens only rarely for large N. Once the 
period r is found, the numbers 



m± = x^ 2 ± 1 



(2) 



generally share either p or q with N as a common factor. Not all choices of x 
give periods r which yields a factor p or q. For instance, sometimes the period 
r will be odd, whence the numbers from eq. (2) can be non-integer. When the 
chosen x does not lead to a valid factor, the procedure can be repeated with 
a different choice until a factor is found. This is efficient since the probability 
of success is at least \ per trial for the case of semiprimes (see Shor 0). 

The hard part of the algorithm is determining the period r of the function 
fx{a) = x a (mod N). Shor found a very elegant and efficient means of doing 
this quantum mechanically, depicted schematically in fig. 1. Consider that one 
has two quantum registers (one of size In where n = [log N] qubits and the 
second of size n qubits. We will denote the basis states of a quantum register 
by | a), with a G {0 . . . 2 2n — 1}. The binary representation of a indicates which 
register qubits are in the state representing zero and which are in the state 
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representing one. A general state of a 2n qubit register \ip(t)) at time t can 
thus be written as a superposition of basis states, 



m))= E ««(*)!«>, (3) 



a=0 



where a a (t) is a complex number, normalised such that X^o" 1 l^aWI 2 = 1- 
The algorithm begins by preparing the larger quantum register in an equal su- 
perposition (2 2n ) -1 / 2 Y^a^Q 1 | a) of all possible 2 2 ™ basis states while the smaller 
register is prepared in the definite state |1) (= |0 . . . 01)). The initial state of 
both registers is thus 



*fe)> = ^ I>>|1> ( 4 ) 



a=0 



The next step is a unitary transformation which acts on both registers accord- 
ing to U\a)\b) = \a)\bx a (mod N)) giving the output state 



Mta)} = - E \a)\x a (mod N)} (5) 

Z a=0 

Then an inverse quantum Fourier transform (IQFT) defined by 



Q- l \y) = ^ ^- 2myz,22n \z) (6) 



2 = 



is applied, which transform the state \^(t a )) from eq. (5) into 



Mt q )} = Wn E E e" 2 — Z 22 " ^^(mod iV)). (7) 

z a =0 2=0 

By measuring the larger register in the computational basis we obtain an 
integer number c. Now c/2 2n is a close approximation to the fraction k/r, 
where < k < r, the value of k varies depending on the particular value 
of c that is measured, but both r and k can be obtained classically using 
continued fractions (provided c ^ 0). Choosing the larger register to be 2n 
qubits provides a high enough accuracy for c such that r can be determined 
from a single measurement on all 2n qubits. It is possible to use fewer qubits 
in this first register but the probability of correctly determining r decreases, 
and the algorithm may need to be repeated correspondingly many more times. 
If r is not prime, and happens to share a factor p with k, then one also fails 
to determine r correctly, instead obtaining r/p. Again, this only reduces the 
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Fig. 2. Entanglement between the two registers (squares) and within the smaller 
register (circles) in Shor's 12 qubit algorithm as a function of gates sequence ac- 
cording to fig (1) with the co-prime chosen as x = 13. The entanglement within the 
larger register is zero throughout. 

probability of success by a factor polynomial in N, so the exponential nature 
of the speed up is maintained. 



3 Factoring 15 

We start our analysis of the entanglement by studying the circuit for factoring 
15 (3x5), though it is not necessarily typical of factoring larger numbers. Since 
many gates make no change to the entanglement, rather than tracking the 
entanglement as each basic gate is applied, we choose to look at certain key 
points in the algorithm. We restrict our attention to controlled composite 
gates: the U x (j) gate which implements the operation a;-' (mod N) for j 6 
{1,2,4. . . 2 2 ™}, and the rotations in the IQFT. Details of how to efficiently 
construct these composite gates from a universal set of one and two qubit 
gates may be found in, for example, 0. There are 8 of the U x (j) gates (in 
general 2n, one for each larger register qubit), which is manageable, but for 
the IQFT there are 27 (in general (2n + l)(n — 1) for a 2n qubit register) 
rotation gates: for our purposes in this paper it is sufficient to treat the whole 
IQFT as one unit. Along with single qubit gates as necessary, the circuit using 
these composite gates is depicted in fig. 1. 

As we are only considering the evolution of pure states we can measure the 
entanglement between the two registers using the entropy of the subsystems 



where the {Aj} are the eigenvalues of the reduced density matrix of either of 
the registers (both have the same eigenvalues). The reduced density matrix 
of one of the registers is obtained from the full pure state of the system by 



E c = - A; log A, 
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applying a partial trace over the other register, 

p L (t)=Tr s m)){*(t)\, (9) 

and similarly ps(t) = Tr^|^I'(t))(\[ / (t)|, where L and S denote the larger and 
smaller registers respectively. 

To quantify the entanglement within each register is not so straightforward. 
Most entanglement measures for mixed states, such as pi and pg, are compu- 
tationally intractable in practice for more than a few qubits; we also need to 
consider all the possible divisions of the qubits into different subsets in order to 
locate all of the entanglement. A reasonable approximation to quantifying the 
entanglement within a register can be obtained by applying a partial transpose 
to each possible subset of qubits and calculating the negativity 24 , 25| given 
by i] = Tr|p T | — 1 i.e., the sum of the negative eigenvalues of the transposed 
matrix or p^. If the negativity is zero for all possible subsets of qubits in 
the register, then we can say that at most the register has bound entangle- 
ment [26j ]. which is not generally considered useful for quantum information 
tasks (though see Non-zero negativity for any subset of qubits definitely 
indicates the presence of entanglement (across that particular division). 



Finally, we use the entanglement of formation |28| to quantify the pairwise 
entanglement between two qubits. The entanglement of formation quantifies 
how much entanglement is needed to make the state from unentangled in- 
gredients. In general it is hard to calculate explicitly, however, Wootters [i^ 
found an elegant formula for the case of two qubits in a mixed state p, the 
concurrence C is given by C = max(Ai — A2 — A3 — A4,0), where the A» are 
the square roots of the eigenvalues of pp = p Oy®Oyp*Oy®Oy, with A, B 
labels for the two qubits, o y the Pauli spin operator, and p* denotes the com- 
plex conjugation of p in the computational basis {|00), |01), |10), |11)}. The 
entanglement of formation Ef = h{\ + — C 2 ), where h(r]) is the binary 
entropy function, h{rf) = —r]\og(r]) — (1 — 77) log(l — 77). We use Ef to check 
for pairwise entanglement within and between the qubit registers. Note that 
quantum states can be highly entangled even without containing any pairwise 
entanglement [2^, 0] • 

In fig. 2 we plot the entanglement in Shor's algorithm using the entropy of 
the subsystem where possible (full state is pure) and the negativity where 
the single register state is mixed. The negativity turns out to be zero for 
both registers throughout the algorithm (except the measurement leaves the 
smaller register entangled, but this cannot be useful for the remaining classical 
steps of the algorithm). The entanglement between the registers builds up to 
a maximum during the first two U x (j) gates, then stays constant until the 
measurement. We also note (from calculating the entanglement of formation 
for appropriate pairs of qubits) that there is no pairwise entanglement between 
any pair of qubits at any of the sampled points in this instance of the algorithm, 
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Fig. 3. Pattern of entanglement during Shor's algorithm factoring N = 15 with 
co-prime x = 13. After the U x (j) gates the top two qubits in the larger register 
(filled) are entangled with the four qubits in the smaller register. After the IQFT, 
the entanglement is transfered to the lower two qubits in the larger register. Qubits 
represented by open circles are not entangled. Time sequence corresponds to fig. 1. 



neither within nor between the registers. 

Since the IQFT is the crucial step for finding the period, we looked in more 
detail at how the distribution of the entanglement changes over the operation 
of the IQFT. Unitary operations can only alter entanglement within the ele- 
ments they are applied to. Applying this principle to the circuit in fig. 1, since 
the entanglement within each register is zero (strictly speaking, zero apart 
from possible bound entanglement) after the modular exponentiation, it is 
clear that entanglement cannot decrease during the IQFT, since no further 
gates act where the only significant entanglement is located, between both 
registers. Furthermore, since each pair of qubits in the upper register has an 
entangling (2-qubit) gate applied to it only once during the algorithm, entan- 
glement within the upper register can only be generated or shifted around, 
not decreased. And indeed our numerical calculations show the distribution 
of entanglement between the individual qubits does change in our example of 
factoring 15 with x — 13. By examining the entropy of each possible subset 
of qubits in each register, we can deduce that only two of the eight qubits are 
entangled with the four qubits in the smaller register, and during the action 
of the IQFT, this entanglement is transfered from the top two qubits to the 
bottom two in the larger register. We represent this schematically in fig. 3. 

However, we should remember that 15 is actually extremely easy to factor. It 
is straightforward to see that at least one of x r ^ 2 ± 1 is divisible by 3 or 5 for 
almost any random choice of x, r > 1, regardless of whether x is co-prime to 
A" or whether r is the period of x a (mod N). To learn anything significant, we 
need to look at more examples. 
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Table 1 

Average entropy of subsystems for factoring 21 with x = 2, and average negativity 



(after the IQFT) for different sized subsystems of the larger register. 
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4 Factoring 21 



We next look at factoring 21 (3 x 7). To do this on a quantum computer 
in the same manner as the circuit for factoring 15 shown in fig. 1 requires a 
total of 15 qubits, 10 in the larger register and 5 in the smaller. For co-prime 
x = 13, we find a similar pattern of entanglement to that shown in fig. 3 for 
15 with x = 13, except that for 21 there is only entanglement between one 
qubit in the larger register and two qubits in the lower register. Similarly, the 
IQFT step shifts the entanglement from the top qubit to the bottom qubit 
in the larger register. Again, there is no pairwise entanglement, so the three 
entangled qubits are in a GHZ type of state i.e., one that can be rotated 
into the form a|000) ± 

The larger register is now at the limit of our computational resources for calcu- 
lating the full analysis of the negativity. Instead of calculating the negativity 
for all possible subsets of qubits in a register, we used randomly sampled sub- 
sets, from which we deduce that with high probability for co-prime x — 13 
there is no entanglement within either register at any stage of the algorithm. 
For other choices of co-prime such as x = 2 and x = 4, there is no entanglement 
within either register by the end of the modular exponentiation (U x (j) gates), 
but entanglement is generated within the larger register during the IQFT. 
For these co-primes we also find a more complex pattern in the entropies of 
the subsystems: the entanglement now involves all of the register qubits. The 
details for x = 2 are shown in table 1. Essentially the entanglement becomes 
more multipartite: the average entropy reduces slightly for one and two qubit 
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subsets, while for larger subsets it increases. Examination of the entanglement 
of formation for pairs of qubits taken one in each register shows there is also 
a significant amount of pairwise entanglement (average 0.261 per pair before 
the IQFT) contributing to the total entanglement in the system. The average 
pairwise entanglement of formation between the registers decreases slightly 
(from 0.261 to 0.242) after the IQFT. This change is possible because entan- 
gling gates on the upper register can convert the pairwise entanglement into 
something more multipartite involving more than two of the upper register 
qubits. We will discuss what these entanglement patterns can tell us in the 
next section after we examine larger examples. 



5 Factoring larger numbers 

In order to examine examples with prime factors larger than 3 or 5, we pushed 
our numerical studies as far as we could with this gate model, by analysing 
semiprimes 32 < iV < 64 and 64 < N < 128, which require 18 and 21 qubits 
respectively for the quantum registers. In these cases, though we cannot easily 
calculate a full entanglement analysis, we have calculated the entropy between 
one qubit and the rest of the qubits in both registers, this corresponds to the 
quantities in the third and fourth columns in the top line of table 1. The dif- 
ference in the average entropy AEi before and after the IQFT (corresponding 
to the first entry in the fifth column in table 1), is shown in table 2 grouped by 
the period r, as a total for the whole upper register (so the entry for N = 21, 
r = 6 is 0.624 = 10 x 0.062 from table 1). 

The pattern that emerges is that the closer the period r is to a power of 2, 
the smaller the value of AEi. For r = 2 m , the IQFT is exact giving AEi = 
in all cases. This can be understood by looking at the measurement results on 
the larger register, from which the period r is calculated. Figure 4 shows the 
probability of measuring each possible number c in the larger register at the 
end of running the algorithm for two examples: factoring 119 with co-prime 
92 (period r = 16), and with co-prime 93 (period r = 24). When the period is 
exactly a power of two, the fraction c/2 2n gives the period r exactly, whereas 
when r is not a power of two, the peak probability tries to fall between two 
possible numbers and thus spreads the wavefunction over several adjacent 
numbers. This spread corresponds to increased entanglement in the upper 
register. We should note that the case where r is a power of two is rare for 
large semiprimes, so the different behaviour for r = 2 m does not help to find 
a factor. In fact 32], if N is odd and r = 2 m for all x, it means that the only 
primes that can divide N are one more than a power of 2. There are only 
5 such odd primes known: 3, 5, 17, 257 and 65537. It is somewhat weakly 
conjectured that this is the complete list. But even if there are more, factoring 
such a number is simple: one just trial divides by numbers one more than 
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Table 2 

Average decrease in entanglement —(AEi) between one qubit and the rest during 
the IQFT step (total for upper register, see text for details). 



r (number of co-primes with this r) 
~(AE 1 ) 



2(3) 4(4) 
0.0 0.0 



2 (3) 3 (2) 6 (6) 
0.0 0.706 0.624 



2 (3) 5 (4) 10 (12) 
0.0 0.285 0.256 



2 (3) 3 (2) 
0.0 0.869 



4 (4) 6 (6) 12 (8) 
0.0 0.788 0.706 



2 (3) 3 (2) 
0.0 0.869 



4 (4) 6 (6) 12 (8) 
0.0 0.788 0.706 



2 (3) 4 (4) 
0.0 0.0 



8 (8) 16 (16) 
0.0 0.0 



2(3) 4(4) 
0.0 0.0 



5 (4) 10 (12) 20 (16) 
0.285 0.256 0.226 



2 (3) 3 (2) 
0.0 0.869 



6 (6) 9 (6) 18 (18) 
0.788 0.080 0.071 



2 (3) 3 (2) 5 (4) 6 (6) 10 (12) 15 (8) 30 (24) 
0.0 1.033 0.343 0.951 0.314 0.034 0.031 



2 (3) 3 (8) 
0.0 1.033 



4 (4) 6 (24) 12 (32) 
0.0 0.951 0.869 



2 (3) 3 (2) 4 (4) 6 (6) 8 (8) 12 (8) 16 (16) 24 (16) 48 (32) 
0.0 1.033 0.0 0.951 0.0 0.869 0.0 0.788 0.706 



a power of 2, more precisely, of the form 2 2 " 1 + 1. There are approximately 
log log N of them to test, so this is clearly efficient classically. 
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Fig. 4. Distribution of measurement outcomes for factoring 119 with x = 92 (upper) 
and x = 93 (lower) which have periods r = 16 and 24 respectively. Symbols show 
the probability of measuring the number on the ordinate as the outcome of the 
algorithm; drop lines are for clarity. The upper figure has just 16 peaks, while the 
lower figure shows a significant probability for measuring neighbouring numbers to 
the minor peaks. 

6 Discussion 



i i i 



First, let us summarise what we have found, since there are several steps to the 
deductions, necessitated by the limitations of classical computational power 
available to us. In this particular gate model, the first half of Shor's algorithm, 
the modular exponentiation, generates approximately log r units of entropy of 
entanglement between the two registers [9|. Our simulations suggest that this 
is the only entanglement at this point, the entanglement within each register 
being zero. By examining the gate sequence within the IQFT we then observed 
that the IQFT can only generate entanglement within the upper register, or, 
move entanglement around between the upper register qubits. Our simula- 
tions detected both these possibilities: for N = 15 and N = 21 with co-prime 
x = 13, the entanglement between the registers moves around the upper regis- 
ter qubits, while for N = 21 and x — 2, there is entanglement generated within 
the upper register during the IQFT (detected by the calculating the negativ- 
ity). From examining the entropy of subsets of qubits, we deduced that the 
overall entanglement becomes more multipartite, because the entanglement 
entropy of one and two qubit subsystems decreased, while that of three to 
nine qubit subsystems increased. We then moved on to larger semiprimes, for 
which we could only calculate the one qubit subsystem entropy. Based on the 
pattern for N = 21 just described, we expect this to decrease during the IQFT, 
corresponding to increasing multipartite entanglement, and this is what we 
observed, except where the period r is a power of two, when it remains equal 
to zero. 

The correlation we observe is between entanglement changes in the upper 
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register during the IQFT, and how close the period r is to a power of two. We 
can explain this quite easily in terms of the fraction c/2 2n ~ k/r that is being 
represented in a binary register of size 2n. If r is not a power of two, c is trying 
to fall between two integers, and this results in a spread in the wavefunction in 
the final state of the quantum register, as shown in fig. 4. Extra terms in the 
decomposition of the final state, c.f. eq. (3), correspond to more multipartite 
entanglement. Now suppose we performed the IQFT in some other base than 
two - for example, in base three, perhaps using a quantum register made up of 
qutrits (three-state quantum systems) rather than qubits - the entanglement 
pattern would change completely. The entanglement pattern we have found is 
thus implementation dependent, it does not correlate with the success of the 
algorithm, or the number being factored. Nor is any entanglement used up 
during the course of the computation. 

Our results support the view that entanglement is not used in a quantita- 
tive way to achieve a quantum computation faster than classical computa- 
tion. While entanglement is certainly generated in significant quantities dur- 
ing pure state quantum computation, this is best understood as a b y-p roduct 
of exploiting the full Hilbert space for quantum parallelism 0, HI, I33LI34T] : most 
of Hilbert space consists of highly entangled states (10, E^, so generation of 
entanglement during quantum computation is simply unavoidable. 

This is to be viewed in contrast with quantum communications tasks, where 
maximally entangled pairs of qubits can perform a specific amount of commu- 
nication, using up the entangled pairs in direct proportion to the communica- 
tion achieved. We also note that entanglement is used quantitatively in many 
practical proposals for implementations of a quantum computer, notably [36]: 




this use can be identified with carrying out communications tasks to move the 
quantum data around in the physical qubits. 
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